kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

genprotimg/samples/check_hostkeydoc: support Armonk in IBM signing key subject

Browse Source 
Newer IBM signing keys use `Armonk` in their subject therefore add
support for it.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2024-03-15 15:39:02 +00:00
committed by Steffen Eiden
parent 173fd7cdca
commit ddcfbdc8d2
1 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
genprotimg/samples/check_hostkeydoc
View File

@@ -22,7 +22,8 @@ SIGNATURE_FILE=$(mktemp)
BODY_FILE=$(mktemp)
ISSUER_DN_FILE=$(mktemp)
SUBJECT_DN_FILE=$(mktemp)
DEF_ISSUER_DN_FILE=$(mktemp)
DEF_ISSUER_ARMONK_DN_FILE=$(mktemp)
DEF_ISSUER_POUGHKEEPSIE_DN_FILE=$(mktemp)
CANONICAL_ISSUER_DN_FILE=$(mktemp)
CRL_SERIAL_FILE=$(mktemp)
@@ -30,7 +31,7 @@ CRL_SERIAL_FILE=$(mktemp)
cleanup()
{
rm -f $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE \
$ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_DN_FILE \
$ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_ARMONK_DN_FILE $DEF_ISSUER_POUGHKEEPSIE_DN_FILE \
$CANONICAL_ISSUER_DN_FILE $CRL_SERIAL_FILE
}
trap cleanup EXIT
@@ -124,7 +125,19 @@ canonical_dn()
| LC_ALL=C sort | grep -v $DNTYPE= > $OUTPUT
}
default_issuer()
default_issuer_armonk()
{
cat <<-EOF
commonName = International Business Machines Corporation
countryName = US
localityName = Armonk
organizationName = International Business Machines Corporation
organizationalUnitName = Key Signing Service
stateOrProvinceName = New York
EOF
}
default_issuer_pougkeepsie()
{
cat <<-EOF
commonName = International Business Machines Corporation
@@ -141,12 +154,14 @@ EOF
# stripping off the prefix
verify_default_issuer()
{
default_issuer > $DEF_ISSUER_DN_FILE
default_issuer_pougkeepsie > $DEF_ISSUER_POUGHKEEPSIE_DN_FILE
default_issuer_armonk > $DEF_ISSUER_ARMONK_DN_FILE
sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \
$ISSUER_DN_FILE > $CANONICAL_ISSUER_DN_FILE
if ! diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_DN_FILE
if ! { diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_POUGHKEEPSIE_DN_FILE ||
diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_ARMONK_DN_FILE; } >/dev/null 2>&1
then
echo Incorrect default issuer >&2 && exit 1
fi
@@ -158,13 +173,6 @@ verify_issuer_files()
then
verify_default_issuer
fi
if diff $ISSUER_DN_FILE $SUBJECT_DN_FILE
then
echo Issuer verification OK
else
echo Issuer verification failed >&2 && exit 1
fi
}
cert_time()